jwt_vulnerability_check

Analyze JWT tokens for security vulnerabilities like authentication bypass or data leakage using CyberMCP's backend testing protocol.

Input Schema

TableJSON Schema

Name	Required	Description	Default
`jwt_token`	Yes	JWT token to analyze for vulnerabilities

Implementation Reference

src/tools/authentication.ts:263-349 (handler)

The handler function that analyzes the provided JWT token for common vulnerabilities. It decodes the header and payload, checks the algorithm (e.g., 'none'), expiration, and presence of standard claims like iat, iss, sub.

async ({ jwt_token }) => {
  try {
    // Split the token
    const parts = jwt_token.split(".");
    if (parts.length !== 3) {
      return {
        content: [
          {
            type: "text",
            text: "Invalid JWT format. Expected 3 parts (header.payload.signature).",
          },
        ],
      };
    }

    // Decode header
    const headerBase64 = parts[0];
    const headerJson = Buffer.from(headerBase64, "base64").toString();
    const header = JSON.parse(headerJson);

    // Decode payload
    const payloadBase64 = parts[1];
    const payloadJson = Buffer.from(payloadBase64, "base64").toString();
    const payload = JSON.parse(payloadJson);

    // Check for security issues
    const issues = [];

    // Check algorithm
    if (header.alg === "none") {
      issues.push("Critical: 'none' algorithm used - authentication can be bypassed");
    }

    if (header.alg === "HS256" || header.alg === "RS256") {
      // These are generally good, but we'll note it
    } else {
      issues.push(`Warning: Unusual algorithm ${header.alg} - verify if intended`);
    }

    // Check expiration
    if (!payload.exp) {
      issues.push("High: No expiration claim (exp) - token never expires");
    } else {
      const expDate = new Date(payload.exp * 1000);
      const now = new Date();
      if (expDate < now) {
        issues.push(`Info: Token expired on ${expDate.toISOString()}`);
      } else {
        const daysDiff = Math.floor((expDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
        if (daysDiff > 30) {
          issues.push(`Medium: Long expiration time (${daysDiff} days) - consider shorter lifetime`);
        }
      }
    }

    // Check for missing recommended claims
    if (!payload.iat) {
      issues.push("Low: Missing 'issued at' claim (iat)");
    }
    if (!payload.iss) {
      issues.push("Low: Missing 'issuer' claim (iss)");
    }
    if (!payload.sub) {
      issues.push("Low: Missing 'subject' claim (sub)");
    }

    return {
      content: [
        {
          type: "text",
          text: issues.length > 0
            ? `JWT Analysis Results:\n\nHeader: ${JSON.stringify(header, null, 2)}\n\nPayload: ${JSON.stringify(payload, null, 2)}\n\nSecurity Issues:\n${issues.join("\n")}`
            : `JWT Analysis Results:\n\nHeader: ${JSON.stringify(header, null, 2)}\n\nPayload: ${JSON.stringify(payload, null, 2)}\n\nNo security issues detected.`,
        },
      ],
    };
  } catch (error) {
    return {
      content: [
        {
          type: "text",
          text: `Error analyzing JWT: ${(error as Error).message}`,
        },
      ],
    };
  }
}

src/tools/authentication.ts:260-263 (schema)

Zod input schema defining the required 'jwt_token' parameter.

{
  jwt_token: z.string().describe("JWT token to analyze for vulnerabilities"),
},
async ({ jwt_token }) => {

src/tools/authentication.ts:258-350 (registration)

Direct registration of the 'jwt_vulnerability_check' tool using server.tool(), including schema and handler, within the registerAuthenticationTools function.

server.tool(
  "jwt_vulnerability_check",
  {
    jwt_token: z.string().describe("JWT token to analyze for vulnerabilities"),
  },
  async ({ jwt_token }) => {
    try {
      // Split the token
      const parts = jwt_token.split(".");
      if (parts.length !== 3) {
        return {
          content: [
            {
              type: "text",
              text: "Invalid JWT format. Expected 3 parts (header.payload.signature).",
            },
          ],
        };
      }

      // Decode header
      const headerBase64 = parts[0];
      const headerJson = Buffer.from(headerBase64, "base64").toString();
      const header = JSON.parse(headerJson);

      // Decode payload
      const payloadBase64 = parts[1];
      const payloadJson = Buffer.from(payloadBase64, "base64").toString();
      const payload = JSON.parse(payloadJson);

      // Check for security issues
      const issues = [];

      // Check algorithm
      if (header.alg === "none") {
        issues.push("Critical: 'none' algorithm used - authentication can be bypassed");
      }

      if (header.alg === "HS256" || header.alg === "RS256") {
        // These are generally good, but we'll note it
      } else {
        issues.push(`Warning: Unusual algorithm ${header.alg} - verify if intended`);
      }

      // Check expiration
      if (!payload.exp) {
        issues.push("High: No expiration claim (exp) - token never expires");
      } else {
        const expDate = new Date(payload.exp * 1000);
        const now = new Date();
        if (expDate < now) {
          issues.push(`Info: Token expired on ${expDate.toISOString()}`);
        } else {
          const daysDiff = Math.floor((expDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
          if (daysDiff > 30) {
            issues.push(`Medium: Long expiration time (${daysDiff} days) - consider shorter lifetime`);
          }
        }
      }

      // Check for missing recommended claims
      if (!payload.iat) {
        issues.push("Low: Missing 'issued at' claim (iat)");
      }
      if (!payload.iss) {
        issues.push("Low: Missing 'issuer' claim (iss)");
      }
      if (!payload.sub) {
        issues.push("Low: Missing 'subject' claim (sub)");
      }

      return {
        content: [
          {
            type: "text",
            text: issues.length > 0
              ? `JWT Analysis Results:\n\nHeader: ${JSON.stringify(header, null, 2)}\n\nPayload: ${JSON.stringify(payload, null, 2)}\n\nSecurity Issues:\n${issues.join("\n")}`
              : `JWT Analysis Results:\n\nHeader: ${JSON.stringify(header, null, 2)}\n\nPayload: ${JSON.stringify(payload, null, 2)}\n\nNo security issues detected.`,
          },
        ],
      };
    } catch (error) {
      return {
        content: [
          {
            type: "text",
            text: `Error analyzing JWT: ${(error as Error).message}`,
          },
        ],
      };
    }
  }
);

src/tools/index.ts:13-13 (registration)
High-level registration call to registerAuthenticationTools(server), which includes the jwt_vulnerability_check tool.
```
registerAuthenticationTools(server);
```

CyberMCP